Privacy policy

Last updated: 23 October 2026

This notice explains how we process personal data when you use Quizhat (quizhat.app), in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

1. Data controller and contact details

The data controller is FESTALAUREA SRLS, Via Luigi Mascherpa 18, 35131 Padova (PD), Italy, VAT no. 05743150285, which operates Quizhat.

• Email: festalaurea.info@gmail.com (for any privacy question and to exercise your rights)
• PEC (certified email): festalaurea@pec.it

We have not appointed a data protection officer (DPO), because it is not mandatory for our activity (art. 37 GDPR): you can use the contact details above for any request.

2. Quizhat's two roles

• For those who create an account (trainers, teachers, organisations, event organisers) we are the controller of the account data: we decide how and why it is processed, within the limits described here.
• For those who take part in a quiz the controller is whoever organises the session (the training provider, the company, the school, the event organiser). Quizhat processes that data on their behalf and according to their instructions, as a processor (art. 28 GDPR), under the Data Processing Agreement that forms part of the Terms of service. The organiser decides which data to request, for what purpose and on what legal basis, and must provide you with their own privacy notice. If you are a participant and wish to exercise your rights, contact the organiser; if you write to us, we forward the request to the organiser and help them reply to you.

3. What data we process

Account (trainers and organisers)

• Registration data: name, email and password. The password is stored only as a cryptographic fingerprint (Argon2 hash): we cannot read it.
• Sign-in with Google or Microsoft, if you choose it: we receive from the provider your name, email address and an account identifier. We do not receive the password or access to any other data in your Google or Microsoft account.
• Plan data: plan chosen, trial expiry, subscription status, usage counters (for example uses of the AI features in the month and their consumption, to keep costs under control).
• Billing data (paid plans): name or company name, address, country, VAT number or tax code, SDI recipient code or PEC address, Stripe customer and subscription identifiers, and invoices. Card details are processed directly by Stripe: Quizhat does not see or store them.
• Organisation data, if you enter it: name of the organisation or practice and logo, which appear on official records, certificates and the screen; courses, client folders (name of the client company, VAT number and contact person, if you provide them).
• Your content: quizzes, questions, uploaded images, links to YouTube videos, documents and texts you send to the AI features, collections, session reports.
• Public library: if one of your quizzes is public, the account name appears next to the quiz as its author (this is the attribution required by the CC BY licence). If you prefer, you can use the name of an organisation or a pseudonym as the account name.
• Reports: if you report a quiz in the library we record the reason and, if you are signed in, your account.
• Communications: the emails you write to us and our replies.

Participants (on behalf of the organiser)

• The nickname chosen to play, the avatar and any team.
• In Test mode and when the organiser requests it: first name, surname and the other fields the organiser chooses (for example company or employee/student number).
• The answers given, response times, score, result and attempts.
• In Test mode: session events (joining, leaving, submission) and the number of times the participant left the page during the test, which the organiser sees in the report and in the official record.
• If the organiser uploads a list of enrolled participants: first name, surname, company and possibly email, with a personal link to the test; if the organiser requests it, we send the link by email.
• If the organiser generates a certificate: name, course, date and result, with a code that allows anyone holding it to check its validity on a public page (not indexed by search engines).
• Effectiveness follow-ups (Organisation plan): if the organiser schedules one, declaring that they have informed the participants, a few months after the course we send the enrolled participants an email with a short optional questionnaire.

No account is needed to take part and Quizhat does not ask for an email address or phone number, unless the organiser enters them.

Technical and browsing data

To operate and protect the site, our systems process technical data such as IP address, browser type, and the date and time of requests. IP addresses used to limit sign-in attempts and repeated registrations are kept only in the server's memory, for one hour at most. On your device we store only technical cookies and storage, described in the Cookie policy. We collect visit statistics with GoatCounter, installed on our own servers, without cookies and without storing the IP address. We do not carry out profiling or advertising.

Providing account data is necessary to use the reserved features: without it, we cannot create the account. Billing data is necessary to purchase a paid plan, keep the accounting records and issue the invoice (always for businesses and professionals, on request for private individuals).

4. Purposes and legal bases (account and site)

• Providing the service: account, sign-in, creating quizzes, live sessions, reports, official records, certificates, support. Basis: performance of the contract (art. 6(1)(b) GDPR).
• Service emails: address confirmation, welcome with instructions to get started, password reset, security alerts (password or email changed, new sign-in method), confirmation of account deletion, communications about the plan and the terms. Basis: performance of the contract and legitimate interest in account security. We do not send newsletters or promotional emails.
• Payments, invoicing and accounting: basis: contract (art. 6(1)(b)) and legal tax and accounting obligations (art. 6(1)(c)).
• AI features (question generation, questions from a document, translation): basis: performance of the contract, only when you use them.
• Public library: publishing public quizzes with the author's name. Basis: contract (it is the visibility setting of the plan and the CC BY licence you accept).
• Security, abuse prevention and handling of reports, including limits on sign-in attempts and the removal of illegal content: basis: legitimate interest (art. 6(1)(f)) and legal obligations (Regulation (EU) 2022/2065 on digital services).
• Anonymous visit statistics, to understand which pages are useful: basis: legitimate interest (art. 6(1)(f)); the tool does not use cookies and does not identify visitors.
• Defence of our rights in the event of disputes: legitimate interest (art. 6(1)(f)).

We do not take decisions based solely on automated processing that produce legal effects concerning you (art. 22 GDPR). In Test mode the score is calculated automatically, but the result of the test and its consequences are decided by the course organiser.

5. Providers and recipients

Data is not sold or used for advertising. Only authorised persons at FESTALAUREA SRLS who are bound by confidentiality, and the providers below, each to the extent necessary, have access to the data. Providers that process data on our behalf are appointed as processors by contract (art. 28 GDPR).

• Aruba S.p.A. (Italy): virtual server (Aruba Cloud) in a data centre in Italy, which hosts the application, the database, uploaded images, backups and statistics; domain registration.
• Resend (Resend, Inc., United States): sending service emails and, at the organiser's request, links to tests and follow-up questionnaires. It receives the recipient's address, their name and the text of the message.
• Anthropic (Anthropic PBC, United States, and its affiliates): only when a trainer uses the AI features. It receives only the text or document the trainer sends (for example a handout) or the quiz to be translated. Participants' data is never sent. Under Anthropic's commercial terms, data sent via the API is not used to train the models. We ask you not to include personal data in the documents and texts sent to the AI.
• Stripe (Stripe Payments Europe, Limited, Ireland): payments, subscriptions, invoices and the subscription management portal. It receives name, email, billing address, tax and payment data. For fraud prevention and the legal obligations of the payments sector Stripe acts as an independent controller, under its privacy policy.
• Google and Microsoft: only if you choose to sign in with their account. They provide us with name, email and account identifier; for sign-in they act as independent controllers, under their own privacy policies.
• YouTube (Google Ireland Limited): only in quizzes where the author inserts a video, the player is loaded from YouTube in privacy-enhanced mode and Google receives the device's IP address (see the Cookie policy). Google acts as an independent controller.
• Google (Gmail): the emails you send to our contact address are received in the festalaurea.info@gmail.com mailbox.
• The company's accountant and advisers, for bookkeeping and tax compliance, and the Sistema di Interscambio (SDI) of the Agenzia delle Entrate (Italian Revenue Agency) for electronic invoices.
• Authorities, when required by law.

Fonts are hosted on our own servers: the pages make no requests to Google Fonts or to other statistics or advertising services.

6. Transfers outside the European Union

The database, images and backups remain in Italy. Some providers (Resend, Anthropic and, for some activities, Stripe, Google and Microsoft) may process data in the United States or in other countries outside the European Economic Area. In these cases the transfer takes place only with the safeguards provided for by the GDPR: the European Commission's adequacy decision on the EU-US Data Privacy Framework (art. 45), for certified providers, or the standard contractual clauses approved by the Commission (art. 46), included in each provider's data processing agreement. You can ask us for information on the safeguards used by writing to the contact address.

7. How long we keep data

• Account and content: as long as the account is active. You can delete your account at any time from the Account page: the account, quizzes, questions, images, courses, reports and the participants' data of your sessions are deleted immediately (if you have an active subscription, it must be cancelled first).
• Session reports and participants' data: they remain in the organiser's account as long as the account exists, so that the organiser can keep the course file (the Trainer and Organisation plans include the archive for 10 years). On the Free plan reports can be viewed for 30 days, but they are not deleted: they become visible again if you switch to a paid plan. The organiser can delete a single session from their report at any time (“Delete session”): the participants, answers, scores, enrolled participants, certificates and follow-ups of that session are deleted immediately (from backups within about 14 days).
• Accounting data and invoices: 10 years, as required by law (art. 2220 of the Italian Civil Code and tax rules), even after the account is deleted.
• Backups: every night we make a backup copy of the database and images; we keep the last 14 copies, so deleted data also disappears from backups within about 14 days.
• Sign-in session: 30 days, after which you need to sign in again.
• Links sent by email: the password reset link is valid for 1 hour and the email confirmation link for 48 hours; both can be used only once and we store only their fingerprint (hash).
• Server technical logs: rotated automatically and deleted within a few weeks; they do not contain participants' answers.
• Statistics: aggregated and anonymous data, kept without time limit because it does not relate to identifiable persons.
• Support emails: for as long as necessary to handle the request and any disputes, as a rule no longer than 2 years.

8. Security

We use appropriate technical and organisational measures: always-encrypted connections (HTTPS), passwords stored only as Argon2 hashes, server access only with a cryptographic key and firewall, limits on sign-in attempts, checks that prevent one account from seeing another's data, daily backups. In the event of a personal data breach that presents a risk to individuals, we notify the Garante (Italian Data Protection Authority) and, where necessary, the data subjects, within the time limits and in the manner provided for by Articles 33 and 34 of the GDPR.

9. Your rights

You can request at any time to:

• access your data and receive a copy (art. 15);
• correct or complete it (art. 16);
• erase it (art. 17), including by deleting your account from the Account page;
• restrict its processing (art. 18);
• receive it in a structured, machine-readable format, or have it transmitted to another provider (portability, art. 20): from the Account page you can download your data in JSON format;
• object to processing based on legitimate interest (art. 21).

Write to festalaurea.info@gmail.com: we reply without delay and in any case within one month (extendable by two months in complex cases, in which case we will let you know). We may ask you to confirm your identity. If you believe your data is being processed in breach of the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) (art. 77) or apply to the courts.

If you are a participant, for data collected in a session contact the organiser first, as they are the controller: we help them reply.

10. Minors

Accounts are reserved for adults who use Quizhat for work, study or to organise an event. Students, including minors, can take part in quizzes without an account under the responsibility of the school or teacher organising the session, who is the controller of their data, decides which data to request and assesses its legal basis. For minors we recommend using only a nickname that does not allow them to be identified.

11. Changes

We may update this notice, for example when the features of the service or the providers change. The date of the last update is at the top of the page; for significant changes we notify account holders by email.